Who enforces the UAE PDPL?

The UAE Data Office is the supervisory authority for Federal Decree-Law No. 45 of 2021. Controllers report breaches to it, and data subjects can complain to it. Penalty amounts are not yet set: Article 26 leaves the violations and administrative penalties to a Cabinet decision, unpublished as of September 2026. The DIFC and ADGM have their own regulators.

A personal data breach is notified to the UAE Data Office and to the affected data subjects, without undue delay.

Entities established in the DIFC answer to the DIFC’s Commissioner of Data Protection, and those in the ADGM to ADGM’s Office of Data Protection, each under its own free zone’s law and penalties.